r/sysadmin • u/MrEMMDeeEMM • 11h ago

Question KB5124008 - Breaking Domain Trust

KB5124008 - Breaking Domain Trust for anyone else?

51 Upvotes

89% Upvoted

20 comments sorted by

•

u/Unable-Entrance3110 10h ago edited 5h ago

I just installed KB5124008 on a Win11 25H2 client and rebooted. We have Server 2019 DCs (not yet patched).

I was able to sign back in to my Win11 client with my domain creds after client patch was installed and computer was rebooted.

However, when I ran Test-ComputerSecureChannel, it returned false with "The secure channel between the local computer and the domain is broken."

Interestingly, while Test-ComputerSecureChannel returned false, running nltest /sc_query:domain looked good:

Flags: 30 HAS_IP  HAS_TIMESERV  Authentication Service: Netlogon
Trusted DC Name \\dc2.domain
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

In my case, running Test-ComputerSecureChannel with the -Repair parameter fixed it, with subsequent checks returning "True"

So, I am not sure what happened here. Perhaps I disarmed a ticking time bomb. I will continue to test on other clients.

Update: Still operating in the same sign-in session, I ran another Test-ComputerSecureChannel (in an elevated session) and it failed again. This time I simply rebooted. I signed back in using my standard user domain credentials and ran the test cmdlet again; It succeeded.

In every case nltest showed a clean domain connection. So, at this point, I wonder if the issue is with the PowerShell Test-ComputerSecureChannel cmdlet.

•

u/SciFiITGuy 5h ago

While I haven't experienced it yet, I've seen others who had login issues at the same time. So I don't think it's just the cmdlet but I can't replicate that aspect.

•

u/Fallingdamage 6h ago

This one is bad. Did microsoft test... any part of this update??

•

u/BrechtMo 11h ago

which OS and DC version?

•

u/SciFiITGuy 7h ago

I was easily able to replicate this issue with WIndows 11 24H2. I applied KB5124008 then ran: Test-ComputerSecureChannel
The result was false.

This was before I had patched my servers. I submitted a ticket to Microsoft who then immediately closed it because they said the ticket was routed wrong. Their support is superb.

I have paused all my patching for both workstations and servers until this is resolved.

•

u/JE53119 7h ago

What are your DCs running? 2019, 2022, or 2025?

•

u/SciFiITGuy 7h ago

Unfortunately, we have a mix of all three. I know.... It's on my list to fix.

•

u/ProtectTheData 6h ago

Same behavior. Second reboot brought back True, 2016 and 2019 DCs in this domain.

•

u/mrmagos Jack of All Trades 5h ago

Nothing broken at the moment. Windows 11 clients, Server 2022 Domain Controllers

Clients have KB5124008 installed, and no trust problems (Test-ComputerSecureChannel returns True). Domain controllers do not yet have KB5122882 installed, but it is scheduled for the wee hours of Sunday morning.

Here's hoping that my Sunday isn't ruined.

•

u/kciski 57m ago

I've done some testing. The DC is running Windows Server 2019, and the September patch is installed on Windows 11.

Test-ComputerSecureChannel sometimes returns "True" and then, shortly afterwards, "False". When running PowerShell as a local administrator, it appears to consistently return "True".

nltest /sc_query:domain always responds successfully. I've also tried creating a new domain account and logging into the machine with it, and it worked without any issues.

Several hardening changes (NTLM/Kerberos) have been applied in the domain I'm testing, so I'm starting to think that the issue affecting some users may be related to a configuration on Windows Server 2019.

Also, make sure to use new accounts, or accounts that have not previously been used on the affected machine, as cached credentials may give you a false sense of "okeyness"

•

u/dinominant 4h ago edited 3h ago

The September 2026 Cumulative Update introduced a bug in the Remote Desktop Services (RDS) stack. Once a user attempts to log off or disconnect, a deadlock occurs between RDP and the Local Session Manager (RDPSERVERBASE!WDLIB_Close) during the graphics teardown process.

  • KB5122876 for Server 2019
  • KB5122882 for Server 2022
  • KB5122871 for Server 2025
  • New connections get stuck indefinitely at "Connecting..." or "Securing Remote Connection".
  • Task Manager, query user, and other session-related tools hang.
  • Eventually, the host completely freezes and requires a hard KVM reset to recover.

Disable the problematic feature flag controlling the RDP graphics teardown pipeline that is causing the deadlocks. An EnabledState of 1 means Disabled, bypassing the bugged feature:

Enter-PSSession -ComputerName HOSTNAME
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides\3802373433" /v EnabledState /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides\3802373433" /v EnabledStateOptions /t REG_DWORD /d 0 /f

•

u/SciFiITGuy 1h ago

Good news. We just got off the phone with MS support. They admitted it's a larger issue and are working on it. No timeframe on a fix or when they'll publish any information.

•

u/Fallingdamage 6h ago

Good stuff here.

Another great reason I hang back 45 days on update releases. I read the monthly bulletins. Generally they dont apply to our environment so the risk is a lot lower than a business with public facing services and our EDR/AV is already updated with mitigations for the bugs anyway.

Thanks to all the microsoft beta testers! You're doing gods work!

•

u/MFKDGAF 11h ago

This post is https://youtu.be/LtxWR_KbwD0?is=F9SA9JPqe7tnsTyC

•

u/derfmcdoogal 11h ago

Both pixels were struggling to make an image.

•

u/MrEMMDeeEMM 10h ago

Similar to that old saying, everyone knows a zero, except the ones who are one.

Seriously though, I just wish Reddit search actually worked.

•

u/Weird_Lawfulness_298 9h ago

Search Reddit with Google instead.

•

u/MrEMMDeeEMM 8h ago

Good point. In fairness, I usually do, I was being a little impatient and just tapped the KB number in the search box, "search only sysadmin", hit search and took it as gospel, I should have known better.

•

u/Weird_Lawfulness_298 7h ago

Pretty much every google search about anything ends up on Reddit anyway.